Sigma Watch is free and independent. If it saves you time, keep it running. ☕ Buy me a coffee
SigmaWatch
ATT&CK technique

T1547.001

Registry Run Keys / Startup Folder

PersistencePrivilege Escalation 58 detections found
View on MITRE ATT&CK →

Detection rules

Source Rule Status Updated
splunk Registry Keys Used For Persistence production 2026-10-09
splunk Windows Boot or Logon Autostart Execution In Startup Folder production 2026-10-06
elastic Startup or Run Key Registry Modification production 2026-10-05
elastic Persistence via a Windows Installer production 2026-10-05
splunk Windows Registry Modification for Safe Mode Persistence production 2026-10-02
splunk Windows Registry BootExecute Modification production 2026-10-02
elastic Persistent Scripts in the Startup Directory production 2026-09-18
elastic Startup Folder Persistence via Unsigned Process production 2026-09-18
elastic Startup Persistence by a Suspicious Process production 2026-09-18
elastic Execution of Persistent Suspicious Program production 2026-09-18
elastic Uncommon Registry Persistence Change production 2026-09-18
elastic Suspicious Startup Shell Folder Modification production 2026-09-18
elastic Potential REMCOS Trojan Execution production 2026-09-18
elastic Persistence via WMI Standard Registry Provider production 2026-09-18
elastic Lateral Movement via Startup Folder production 2026-09-18
elastic Persistence via Hidden Run Key Detected production 2026-09-18
elastic Potential Persistence via Mandatory User Profile production 2026-09-18
sigma Office Autorun Keys Modification test 2026-08-28
splunk Windows NorthStar C2 Agent Execution production 2026-05-13
splunk Windows PowerShell MSIX Package Installation production 2026-05-13
sigma Direct Autorun Keys Modification test 2026-01-05
sigma Modify User Shell Folders Startup Value test 2026-01-05
sigma User Shell Folders Registry Modification via CommandLine experimental 2026-01-05
sigma Wow6432Node CurrentVersion Autorun Keys Modification test 2025-12-08
sigma Startup Folder File Write test 2025-12-03
sigma Common Autorun Keys Modification test 2025-10-22
sigma Classes Autorun Keys Modification test 2025-10-22
sigma CurrentVersion Autorun Keys Modification test 2025-10-22
sigma Wow6432Node Windows NT CurrentVersion Autorun Keys Modification test 2025-10-22
sigma CurrentVersion NT Autorun Keys Modification test 2025-10-22
sigma Suspicious Startup Folder Persistence test 2025-10-12
sigma New RUN Key Pointing to Suspicious Folder experimental 2025-10-06
sigma Windows Event Log Access Tampering Via Registry experimental 2025-08-16
sigma Suspicious PowerShell In Registry Run Keys test 2025-07-18
sigma WinRAR Creating Files in Startup Locations experimental 2025-07-16
sigma Potential Persistence Attempt Via Run Keys Using Reg.EXE test 2025-02-17
sigma Suspicious Run Key from Download test 2025-02-17
sigma Suspicious Autorun Registry Modified via WMI experimental 2025-02-17
sigma Kapeka Backdoor Autorun Persistence test 2024-07-03
sigma Forest Blizzard APT - Custom Protocol Handler Creation test 2024-04-23
sigma Forest Blizzard APT - Custom Protocol Handler DLL Registry Set test 2024-04-23
sigma Potential KamiKakaBot Activity - Winlogon Shell Persistence test 2024-03-22
sigma Registry Persistence via Explorer Run Key test 2023-12-11
sigma Registry Set With Crypto-Classes From The "Cryptography" PowerShell Namespace test 2023-12-01
sigma Leviathan Registry Key Activity test 2023-09-19
sigma System Scripts Autorun Keys Modification test 2023-08-17
sigma Wow6432Node Classes Autorun Keys Modification test 2023-08-17
sigma VBScript Payload Stored in Registry test 2023-08-17
sigma WinSock2 Autorun Keys Modification test 2023-08-17
sigma Session Manager Autorun Keys Modification test 2023-08-17
sigma Internet Explorer Autorun Keys Modification test 2023-08-17
sigma CurrentControlSet Autorun Keys Modification test 2023-08-17
sigma File Creation In Suspicious Directory By Msdt.EXE test 2023-02-23
sigma Potential Startup Shortcut Persistence Via PowerShell.EXE test 2023-02-23
sigma Potential Ryuk Ransomware Activity stable 2023-02-03
sigma Potential Suspicious Activity Using SeCEdit test 2022-12-30
sigma Suspicious VBScript UN2452 Pattern test 2022-10-09
sigma Narrator's Feedback-Hub Persistence test 2022-03-26